rule Remcos
{
meta:
 author = "@neonprimetime"
 description = "Remcos RAT"
strings:
 $a1 = "Software\\Remcos"
 $a2 = "\\remcos\\"
 $a3 = "REMCOS v"
 $b1 = "Keylogger Started"
 $b2 = "Connected to C&C"
 $b3 = "Screenshots"
 $b4 = "OpenCamera"
 $b5 = "Uploading file to C&C"
 $b6 = "Initializing connection to C&C"
 $b7 = "cleared!]"
 $b8 = "EnableLUA /t REG_DWORD /d 0"

 $b9 = "Uploading file to C&C"
 $b10 = "%02i:%02i:%02i:%03i"
 $b11 = "[Firefox StoredLogins Cleared!]"
 $b12 = "licence_code.txt"

condition:
 1 of ($a*) or 3 of ($b*)
}
